{"id":22174,"date":"2026-09-26T12:15:15","date_gmt":"2026-09-26T08:45:15","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%a8%d8%b1%d8%b1%d8%b3%db%8c-%d9%81%d8%a7%db%8c%d9%84%d9%87%d8%a7%db%8c-log-%d8%ad%d8%b0%d9%81%d8%b4%d8%af%d9%87-%db%8c%d8%a7-%d8%af%d8%b3%d8%aa%da%a9%d8%a7%d8%b1%db%8c\/"},"modified":"2026-09-26T12:56:28","modified_gmt":"2026-09-26T09:26:28","slug":"deletedlog-checkup","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/deletedlog-checkup\/","title":{"rendered":"\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u062d\u0630\u0641\u200c\u0634\u062f\u0647 \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u062f\u0631 Linux \u0648 Windows"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u0644\u0627\u06af\u200c\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0631\u062e\u062f\u0627\u062f\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c Troubleshooting \u0648 \u062a\u062d\u0644\u06cc\u0644 Incident \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0632\u0645\u0627\u0646 \u0648\u0642\u0648\u0639 \u06cc\u06a9 \u062d\u0627\u062f\u062b\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639\u06cc \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0634\u0627\u0645\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Authentication Logs\nSystem Logs\nApplication Logs\nSecurity Events\nAudit Logs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f\u060c \u062d\u0630\u0641 \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc Log\u0647\u0627 \u0628\u0631\u0627\u06cc \u067e\u0646\u0647\u0627\u0646 \u06a9\u0631\u062f\u0646 \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u062d\u0630\u0641 Login\u0647\u0627\u06cc SSH<\/li>\n\n\n\n<li>\u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 Windows Security Event Log<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 Timestamp \u0641\u0627\u06cc\u0644\u200c\u0647\u0627<\/li>\n\n\n\n<li>\u062d\u0630\u0641 Log\u0647\u0627\u06cc Application<\/li>\n\n\n\n<li>\u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 History \u062f\u0633\u062a\u0648\u0631\u0627\u062a<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 Permission \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0628\u0631\u0631\u0633\u06cc \u0648\u0636\u0639\u06cc\u062a Log\u0647\u0627 \u0648 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc Tampering \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0631\u0627\u062d\u0644 \u0645\u0647\u0645 \u062f\u0631 Incident Response \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log\u0647\u0627 \u062f\u0631 Linux \u0648 Windows \u06a9\u062c\u0627 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.<\/li>\n\n\n\n<li>\u0686\u06af\u0648\u0646\u0647 \u062d\u0630\u0641 \u0634\u062f\u0646 \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0622\u0646\u0647\u0627 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0646\u06cc\u0645.<\/li>\n\n\n\n<li>\u0686\u06af\u0648\u0646\u0647 Integrity \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645.<\/li>\n\n\n\n<li>\u0686\u06af\u0648\u0646\u0647 Event Log\u0647\u0627\u06cc Windows \u0631\u0627 \u062a\u062d\u0644\u06cc\u0644 \u06a9\u0646\u06cc\u0645.<\/li>\n\n\n\n<li>\u0686\u06af\u0648\u0646\u0647 \u0627\u0632 Audit \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u0645.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 \u0645\u0647\u0627\u062c\u0645 Log\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u0635\u0644\u06cc \u062d\u0630\u0641 Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Hide Activity<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u0647\u0627\u062c\u0645 \u0628\u0639\u062f \u0627\u0632 Login \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Attacker Login\n        |\n        v\nExecute Commands\n        |\n        v\nDelete Logs\n        |\n        v\nRemove Evidence<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 \u062d\u0630\u0641 Log\u060c \u0628\u0631\u0631\u0633\u06cc \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062f\u0634\u0648\u0627\u0631\u062a\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0632\u0645\u0627\u0646 \u0648\u0631\u0648\u062f \u0645\u0647\u0627\u062c\u0645<\/li>\n\n\n\n<li>Source IP<\/li>\n\n\n\n<li>\u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u062c\u0631\u0627\u0634\u062f\u0647<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647<\/li>\n\n\n\n<li>Persistence Mechanism<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0646\u0628\u0648\u062f\u0646 \u0641\u0627\u06cc\u0644 Log \u0645\u0647\u0645<\/li>\n\n\n\n<li>\u062e\u0627\u0644\u06cc \u0634\u062f\u0646 \u0646\u0627\u06af\u0647\u0627\u0646\u06cc Log<\/li>\n\n\n\n<li>\u0641\u0627\u0635\u0644\u0647 \u0632\u0645\u0627\u0646\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u062f\u0631 Timestamp\u0647\u0627<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 Owner \u06cc\u0627 Permission<\/li>\n\n\n\n<li>Restart \u0634\u062f\u0646 \u0633\u0631\u0648\u06cc\u0633 Logging \u0628\u062f\u0648\u0646 \u062f\u0644\u06cc\u0644<\/li>\n\n\n\n<li>\u067e\u0627\u06a9 \u0634\u062f\u0646 Windows Event Log<\/li>\n\n\n\n<li>\u0648\u062c\u0648\u062f Command\u0647\u0627\u06cc \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc Log \u062f\u0631 History<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u062d\u062c\u0645 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0641\u0627\u06cc\u0644 Log<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc Linux<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Linux \u0645\u062d\u0644 Log\u0647\u0627 \u0628\u0647 Distribution \u0648 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0633\u062a\u06af\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/\n\/var\/log\/auth.log\n\/var\/log\/secure\n\/var\/log\/syslog\n\/var\/log\/messages\n\/var\/log\/journal\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/log\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-rw------- auth.log\n-rw------- secure\n-rw------- syslog<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062d\u0630\u0641 \u0634\u062f\u0646 \u0641\u0627\u06cc\u0644 Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u0644\u06cc\u0633\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/log -type f<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0645\u0647\u0645\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth.log\nsecure\nmessages<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f \u06a9\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u062d\u0630\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0645\u0633\u06cc\u0631 \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0633\u0631\u0648\u06cc\u0633 Logging \u0645\u0634\u06a9\u0644 \u062f\u0627\u0631\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0632\u0645\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644 Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0633\u062a\u0648\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0631\u0648\u062c\u06cc \u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Access:\n2026-09-26 10:20\n\nModify:\n2026-09-26 10:20\n\nChange:\n2026-09-26 10:20<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Timestamp\u0647\u0627 \u0631\u0627 \u0628\u0627 Timeline Incident \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSH Login:\n10:18\n\nLog Modification:\n10:19<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u0628\u06cc\u0634\u062a\u0631 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062d\u062c\u0645 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 \u0631\u0648\u0634 \u0633\u0627\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lh \/var\/log\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth.log 250MB<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth.log 2KB<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 \u06cc\u06a9 Incident \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0646\u0634\u0627\u0646\u0647 \u062d\u0630\u0641 \u06cc\u0627 Rotate \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Log Rotation<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Linux \u0645\u0639\u0645\u0648\u0644\u0627\u064b Log\u0647\u0627 \u0631\u0627 Rotate \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/log\/auth.log*<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth.log\nauth.log.1\nauth.log.2.gz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0637\u0628\u06cc\u0639\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0627\u06af\u0631 \u0647\u0645\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc \u062d\u0630\u0641 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Journal \u062f\u0631 Linux<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemd-journald<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0627\u06cc\u0634 \u0622\u062e\u0631\u06cc\u0646 \u0631\u062e\u062f\u0627\u062f\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -n 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0633\u0644\u0627\u0645\u062a Journal<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0633\u062a\u0648\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl --verify<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647 \u062e\u0631\u0648\u062c\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PASS: \/var\/log\/journal\/...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>File corrupted or untrusted<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0637\u0627\u06cc \u062f\u0648\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Corruption<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644<\/li>\n\n\n\n<li>\u0645\u0634\u06a9\u0644 Storage<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u062e\u0627\u0644\u06cc \u062f\u0631 Journal<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Timeline:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl --list-boots<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0 boot ...\n-1 boot ...\n-2 boot ...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Boot \u0642\u062f\u06cc\u0645\u06cc \u06cc\u0627 \u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc \u062e\u0627\u0635\u06cc \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0641\u0627\u06cc\u0644 \u0628\u0627 AIDE<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Integrity \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AIDE<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0635\u0628:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install aide<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AlmaLinux:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf install aide<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0627\u062e\u062a Database:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>aide --init<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>aide --check<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AIDE \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0645\u062d\u062a\u0648\u0627<\/li>\n\n\n\n<li>Permission<\/li>\n\n\n\n<li>Owner<\/li>\n\n\n\n<li>Hash<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0628\u0627 Auditd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Auditd \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u063a\u06cc\u06cc\u0631 \u0631\u0648\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0635\u0628:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install auditd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u062c\u0627\u062f Rule:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auditctl -w \/var\/log\/auth.log -p wa<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w = Write\na = Attribute Change<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -f \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Command\u0647\u0627\u06cc \u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc Command\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c \u0628\u0631\u0627\u06cc \u062d\u0630\u0641 Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rm \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"\" &gt; \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>truncate -s 0 \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc History:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/.bash_history<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f History \u0642\u0627\u0628\u0644 \u062d\u0630\u0641 \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc Logging:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status rsyslog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status systemd-journald<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u0636\u0639\u06cc\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl is-active rsyslog<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Linux Audit Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Audit \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/audit\/audit.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/log\/audit\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -ts today<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc Windows<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Windows\u060c \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Log\u0647\u0627 \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Viewer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Viewer\n\nWindows Logs\n |\n + Application\n + Security\n + System\n + Setup<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u067e\u0627\u06a9 \u0634\u062f\u0646 Windows Event Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Windows \u0628\u0631\u0627\u06cc \u067e\u0627\u06a9 \u0634\u062f\u0646 Log\u0647\u0627 Event \u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1102<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0639\u0646\u0648\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>The audit log was cleared<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Event \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f Security Audit Log \u067e\u0627\u06a9 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Event ID 1102<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName=\"Security\"\n    Id=1102\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SubjectUserName\nSubjectDomainName\nTimeCreated<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0686\u0647 Account\u0627\u06cc Log \u0631\u0627 \u067e\u0627\u06a9 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Windows Event Log \u0628\u0627 PowerShell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 Security Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -LogName Security -MaxEvents 50<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0644\u06cc\u0633\u062a Log\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -ListLog *<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062d\u062c\u0645 Event Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -ListLog Security<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>MaximumSizeInBytes\nRecordCount<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a Event Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0631\u0648\u06cc\u0633 Event Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Service EventLog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Running<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u067e\u0627\u06a9 \u0634\u062f\u0646 Log \u0628\u0627 wevtutil<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 Log\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil el<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil cl Security<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Command \u0628\u0627\u06cc\u062f \u062f\u0631 Investigation \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Event\u0647\u0627\u06cc \u0645\u0647\u0645 Windows<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u067e\u0627\u06a9 \u0634\u062f\u0646 Audit Log<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>1102<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u067e\u0627\u06a9 \u0634\u062f\u0646 System Log<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>104<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u062a\u063a\u06cc\u06cc\u0631 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a Audit<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>4719<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0627\u06cc\u062c\u0627\u062f Process<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>4688<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Login \u0645\u0648\u0641\u0642<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>4624<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Login \u0646\u0627\u0645\u0648\u0641\u0642<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>4625<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Audit Policy \u0648\u06cc\u0646\u062f\u0648\u0632<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/get \/category:*<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Audit Logon\nAudit Process Creation\nAudit File System<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Audit \u0646\u0627\u06af\u0647\u0627\u0646 Disable \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc File Integrity \u062f\u0631 Windows<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">System File Checker<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sfc \/scannow<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645\u06cc.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">DISM<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>DISM \/Online \/Cleanup-Image \/CheckHealth<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0641\u0627\u06cc\u0644 \u0628\u0627 PowerShell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem C:\\Windows\\System32\\winevt\\Logs |\nSelect Name,LastWriteTime<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 Event Log\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Windows\\System32\\winevt\\Logs<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Hash \u0641\u0627\u06cc\u0644 Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash C:\\Windows\\System32\\winevt\\Logs\\Security.evtx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062b\u0628\u062a Hash \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u062f\u0648\u0631\u0647\u200c\u0627\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Shadow Copy<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0627\u0647\u06cc \u0645\u0647\u0627\u062c\u0645 Log\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0627\u0645\u0627 \u0646\u0633\u062e\u0647 \u0642\u0628\u0644\u06cc \u062f\u0631 Backup \u06cc\u0627 Shadow Copy \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vssadmin list shadows<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Timeline \u062f\u0631 Incident Response<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062a\u062d\u0644\u06cc\u0644 \u0628\u0627\u06cc\u062f Timeline \u0628\u0633\u0627\u0632\u06cc\u0645:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>10:15\nSSH Login\n\n10:18\nCommand Execution\n\n10:20\nLog Modified\n\n10:21\nService Restart<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u06a9\u0645\u06a9\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Plaso\nTimesketch\nVelociraptor\nAutopsy<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062d\u0630\u0641 Log \u062f\u0631 Linux \u0648 Windows \u0628\u0627 SIEM<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Log\u0647\u0627 \u0641\u0642\u0637 \u0631\u0648\u06cc \u0647\u0645\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0646\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0631\u0633\u0627\u0644 \u0628\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SIEM\nWazuh\nSplunk\nELK\nGraylog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u062d\u062a\u06cc \u062f\u0631 \u0635\u0648\u0631\u062a \u062d\u0630\u0641 Local Log\u060c \u0646\u0633\u062e\u0647 \u0645\u0631\u06a9\u0632\u06cc \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Workflow \u0639\u0645\u0644\u06cc \u0628\u0631\u0631\u0633\u06cc Log Tampering<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Linux<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/log<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Timestamp<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/var\/log\/auth.log<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Journal<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl --verify<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Audit<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -ts today<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u0648\u06cc\u0633 Logging<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status rsyslog<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Windows<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Event 1102<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\nLogName=\"Security\"\nId=1102\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Audit Policy<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/get \/category:*<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Event Log Service<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Service EventLog<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0627\u0639\u062a\u0645\u0627\u062f \u06a9\u0627\u0645\u0644 \u0628\u0647 Local Log\u0647\u0627<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 \u0632\u0645\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Log Rotation<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Event ID 1102<\/li>\n\n\n\n<li>\u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0642\u0628\u0644 \u0627\u0632 \u06af\u0631\u0641\u062a\u0646 Evidence<\/li>\n\n\n\n<li>\u0646\u062f\u0627\u0634\u062a\u0646 Central Logging<\/li>\n\n\n\n<li>\u0646\u062f\u0627\u0634\u062a\u0646 Integrity Monitoring<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Audit Policy<\/li>\n\n\n\n<li>\u0641\u0631\u0636 \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0628\u0648\u062f Log \u06cc\u0639\u0646\u06cc \u0646\u0628\u0648\u062f \u0641\u0639\u0627\u0644\u06cc\u062a<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 Log Tampering:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0631\u06a9\u0632\u06cc \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Integrity Monitoring \u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>AIDE \u06cc\u0627 \u0627\u0628\u0632\u0627\u0631 \u0645\u0634\u0627\u0628\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Auditd \u0631\u0627 \u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Windows Advanced Audit Policy \u0631\u0627 \u062a\u0646\u0638\u06cc\u0645 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u062f\u0633\u062a\u0631\u0633\u06cc Root \u0648 Administrator \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Event\u0647\u0627\u06cc \u067e\u0627\u06a9 \u0634\u062f\u0646 Log \u0631\u0627 Alert \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Backup \u0627\u0632 Log\u0647\u0627\u06cc \u0645\u0647\u0645 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0632\u0645\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627 \u0631\u0627 \u0628\u0627 NTP \u0647\u0645\u0627\u0647\u0646\u06af \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Incident Response Process \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc \u062d\u0630\u0641\u200c\u0634\u062f\u0647 \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc\u200c\u0634\u062f\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0645\u0633\u06cc\u0631 Log\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0645\u0648\u062c\u0648\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Timestamp \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u062d\u062c\u0645 Log\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Log Rotation \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Journal Linux \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Auditd \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>AIDE Integrity Check \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>History \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0633\u0631\u0648\u06cc\u0633 Logging \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Windows Event Viewer \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event ID 1102 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Audit Policy \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event Log Service \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Hash \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Central Logging \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Timeline Incident \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Audit Documentation<\/strong><br><a href=\"https:\/\/github.com\/linux-audit\/audit-userspace?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/linux-audit\/audit-userspace?utm_source=maral.cloud<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AIDE File Integrity Checker<\/strong><br><a href=\"https:\/\/aide.github.io\/?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/aide.github.io\/?utm_source=maral.cloud<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Microsoft Event 1102 Documentation<\/strong><br><a href=\"https:\/\/learn.microsoft.com\/windows\/security\/threat-protection\/auditing\/event-1102?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/windows\/security\/threat-protection\/auditing\/event-1102?utm_source=maral.cloud<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Microsoft Advanced Audit Policy Configuration<\/strong><br><a href=\"https:\/\/learn.microsoft.com\/windows\/security\/threat-protection\/auditing\/advanced-security-audit-policy-settings?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/windows\/security\/threat-protection\/auditing\/advanced-security-audit-policy-settings?utm_source=maral.cloud<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Wazuh File Integrity Monitoring Documentation<\/strong><br><a href=\"https:\/\/documentation.wazuh.com\/current\/user-manual\/capabilities\/file-integrity\/index.html?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/documentation.wazuh.com\/current\/user-manual\/capabilities\/file-integrity\/index.html?utm_source=maral.cloud<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Log\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0647\u0633\u062a\u0646\u062f\u060c \u0627\u0645\u0627 \u0628\u0627\u06cc\u062f \u062f\u0631 \u0646\u0638\u0631 \u062f\u0627\u0634\u062a \u06a9\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u062f\u0627\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u0627\u06cc\u0646 \u0634\u0648\u0627\u0647\u062f \u0631\u0627 \u062d\u0630\u0641 \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Linux \u0628\u0627\u06cc\u062f \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth.log\nsecure\njournal\naudit.log\nauthorized changes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Windows \u0646\u06cc\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security Event Log\nEvent ID 1102\nAudit Policy\nEvent Log Service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u06cc\u0686 \u0646\u0634\u0627\u0646\u0647\u200c\u0627\u06cc \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a\u200c\u06a9\u0646\u0646\u062f\u0647 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u0646\u06cc\u0633\u062a\u061b \u0627\u0645\u0627 \u062a\u0631\u06a9\u06cc\u0628 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9 Incident \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Missing Logs\n+\nUnexpected Timestamp Change\n+\nAudit Disabled\n+\nSuccessful Unauthorized Login\n+\nLog Clearing Event<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062f\u0627\u0634\u062a\u0646 \u062a\u062d\u0644\u06cc\u0644 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f\u060c Log\u0647\u0627 \u0628\u0627\u06cc\u062f \u062e\u0627\u0631\u062c \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0635\u0644\u06cc \u0646\u06cc\u0632 \u0630\u062e\u06cc\u0631\u0647 \u0634\u0648\u0646\u062f \u0648 Integrity \u0622\u0646\u200c\u0647\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062f\u0627\u0648\u0645 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0646\u06cc\u062a Log \u0641\u0642\u0637 \u0628\u0647 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0645\u062d\u062f\u0648\u062f \u0646\u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u0628\u0644\u06a9\u0647 \u0634\u0627\u0645\u0644 \u062b\u0628\u062a \u0635\u062d\u06cc\u062d \u0631\u062e\u062f\u0627\u062f\u0647\u0627\u060c \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632\u060c \u0645\u0627\u0646\u06cc\u062a\u0648\u0631\u06cc\u0646\u06af \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0627\u0632\u0633\u0627\u0632\u06cc Timeline \u067e\u0633 \u0627\u0632 \u062d\u0627\u062f\u062b\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u0644\u0627\u06af\u200c\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0631\u062e\u062f\u0627\u062f\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c Troubleshooting \u0648 \u062a\u062d\u0644\u06cc\u0644 Incident \u0647\u0633\u062a\u0646\u062f. \u062f\u0631 \u0632\u0645\u0627\u0646 \u0648\u0642\u0648\u0639 \u06cc\u06a9 \u062d\u0627\u062f\u062b\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639\u06cc \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0634\u0627\u0645\u0644: \u0647\u0633\u062a\u0646\u062f. \u0627\u0645\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f\u060c \u062d\u0630\u0641 \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc Log\u0647\u0627 \u0628\u0631\u0627\u06cc \u067e\u0646\u0647\u0627\u0646 \u06a9\u0631\u062f\u0646 \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0627\u0633\u062a. \u0628\u0631\u0627\u06cc [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":22198,"parent":17595,"menu_order":68,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-22174","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1790552392","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=22174"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22174\/revisions"}],"predecessor-version":[{"id":22200,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22174\/revisions\/22200"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/22198"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=22174"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=22174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}